Malware Now Has a Board of Directors, and It's Four Chatbots
Cisco Talos finds Windows malware that lets four AI models vote on how to attack you, because even cybercrime has apparently discovered stakeholder alignment.
Somewhere in the pipeline between “AI agents will run your business” and “AI agents will run your ransomware,” a Go developer with access to four API keys built something called CLOSEDQUORUM. Cisco Talos, which found it while testing a new detection toolkit called CAIRN, describes it as the first publicly documented Windows implant that hands its tactical decisions to a committee of large language models instead of a human operator. The malware doesn’t attack you. The malware convenes.
Here is how a quorum decides to ruin your week. Once CLOSEDQUORUM lands on a machine, it gathers whatever reconnaissance it can — what’s running, what’s reachable, what looks stealable — and ships that context out to four separate AI providers: Google Gemini, DeepSeek, Qwen, and Mistral. Each model gets the same prompt and returns one of four permitted verdicts, constrained to a small JSON schema so nobody’s chatbot can get creative: steal, inject, persist, or move. The four votes come back, plurality wins, and the malware executes the group’s decision without asking anyone’s permission — including, notably, the person who wrote it.
The four actions on the ballot are not abstract. Steal means the implant simultaneously drains LSASS credentials, lifts saved passwords out of Chrome, Edge, and Firefox, and goes hunting for cryptocurrency wallets, all at once, because a committee that can only think of one crime at a time isn’t much of a committee. Inject triggers process hollowing to plant itself somewhere less conspicuous. Persist nails down registry keys, scheduled tasks, or WMI subscriptions so it survives a reboot. Move — lateral movement, the part where compromising one machine turns into compromising the network — is, delightfully, unimplemented. The malware can steal your passwords via democratic consensus. It cannot yet spread to your coworker’s laptop. Even AI committees have scope creep problems.
Talos built in tiebreaker logic, because the one thing more embarrassing than malware voting on your data is malware failing to reach quorum: when the panel splits, DeepSeek gets the deciding vote, followed by Qwen, then Mistral, then Gemini. Somewhere there is an org chart for this. Somewhere, someone drew it.
The stolen data doesn’t go to a command server run by a person watching a dashboard. It goes out through Discord webhooks, because in 2026 that is apparently still the exfiltration channel of choice for criminals who would rather not stand up infrastructure. The whole design philosophy, per Talos, is to remove the human from the loop entirely — not for ideology, but for uptime. As one researcher put it, human operators are bound by attention span and working hours; a model that can vote on your credentials doesn’t get tired, doesn’t sleep, and doesn’t need a shift handoff. The attack chain keeps running while the person who built it is, presumably, asleep, or building the next version, or explaining to a forum full of strangers why the “move” function still isn’t done.
There is, mercifully, a catch that undercuts the menace a little: the publicly discovered binary ships with placeholder API keys and dummy webhooks. It doesn’t currently work out of the box. Talos reads this as evidence CLOSEDQUORUM is a template — something built to be configured and resold to paying operators rather than a live, deployed threat. Nobody has found it doing damage in the wild. What Talos found is closer to a proof of concept with delusions of a business model, the malware equivalent of a pitch deck.
None of this required a jailbreak, a leaked model, or a rogue AI going off-script. CLOSEDQUORUM works by using publicly available commercial AI APIs exactly as intended — sending them a prompt, getting back structured JSON, acting on the output. The models involved didn’t misbehave; they answered the question they were asked, which happened to be “how should this compromised machine be looted.” It is the same capability that lets a customer-support bot triage a ticket, pointed instead at a stolen laptop. The technology is neutral in the most unsettling way possible: neutral enough to sit on either side of the ticket queue.
Talos is releasing CAIRN as an open-source toolkit specifically so defenders can watch for this pattern — an application quietly pinging four separate LLM providers in the same session it’s also touching LSASS memory, injecting into processes, or writing WMI persistence. That combination, historically, has had approximately zero legitimate use cases. It is, in the language every enterprise AI vendor uses about their own product, a signal-rich integration. It is also, unfortunately, the first sign that the phrase “multi-agent workflow” now belongs equally to product managers and cybercriminals, and going forward, your security team will need to ask which one built the thing pinging four AI providers on your machine before doing something about your passwords.
Sources: